CVE-2026-82285highCWE-918

CVE-2026-82285: high-severity vulnerability in dataelement bisheng

BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

Published · Updated

Follow this CVE+ Monitor bisheng

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
dataelement · bisheng
Related CVEs — dataelement bisheng

In the same product, most dangerous first.

CVE-2026-82278HIGHBISHENG Authenticated Arbitrary Python Code Execution via Workflow run_onceEPSS 1.0%CVE-2026-111363HIGHBISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bboxEPSS 0.3%